php7-fpm-7.4.33-150400.4.55.1

- security update
- added patches
  CVE-2025-14178 [bsc#1255711], heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE
  * php7-CVE-2025-14178.patch

- security update
- added patches
  CVE-2025-1220 [bsc#1246167], unprocessed null bytes in hostnames can lead to SSRF
  + php7-CVE-2025-1220.patch
  CVE-2025-1735 [bsc#1246146], pgsql extension does not properly handle errors within escape functions
  + php7-CVE-2025-1735.patch
  CVE-2025-6491 [bsc#1246148], NULL pointer dereference when processing a SoapVar with a fully qualified name that is longer than 2G
  + php7-CVE-2025-6491.patch

- security update
- modified patches
  % php-php-config.patch (-p1)
  % php-phpize.patch (-p1)
- added patches
  fix CVE-2024-11235 [bsc#1239666], Reference counting in php_request_shutdown causes Use-After-Free
  + php7-CVE-2024-11235.patch
  fix CVE-2025-1217 [bsc#1239664], Header parser of `http` stream wrapper does not handle folded headers
  + php7-CVE-2025-1217.patch
  fix CVE-2025-1734 [bsc#1239668], Streams HTTP wrapper does not fail for headers with invalid name and no colon
  + php7-CVE-2025-1734.patch
  fix CVE-2025-1736 [bsc#1239670], Stream HTTP wrapper header check might omit basic auth header
  + php7-CVE-2025-1736.patch
  fix CVE-2025-1861 [bsc#1239669], Stream HTTP wrapper truncate redirect location to 1024 bytes
  + php7-CVE-2025-1861.patch
  fix CVE-2025-1219 [bsc#1239667], libxml streams use wrong `content-type` header when requesting a redirected resource
  + php8-CVE-2025-1219.patch

- security update
- added patches
  fix CVE-2024-11233 [bsc#1233702], single-byte buffer overread due to missing bounds check when processing input with convert.quoted-printable-decode filters
  + php7-CVE-2024-11233.patch
  fix CVE-2024-11234 [bsc#1233703], configuring streams with a proxy and the 'request_fulluri' context option might allow for CRLF injection in URIs
  + php7-CVE-2024-11234.patch
  fix CVE-2024-8929 [bsc#1233651], In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests ...
  + php7-CVE-2024-8929.patch

- security update
- added patches
  fix CVE-2024-8925 [bsc#1231360], erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed
  + php7-CVE-2024-8925.patch
  fix CVE-2024-8927 [bsc#1231358], cgi.force_redirect configuration is bypassable due to an environment variable collision
  + php7-CVE-2024-8927.patch
  fix CVE-2024-9026 [bsc#1231382], pollution of worker output logs in PHP-FPM
  + php7-CVE-2024-9026.patch

- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch

- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch

- ensure we are building against openssl-1_1

- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch

- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch

- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch

- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)

- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]

- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch

- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch

- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)

- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)

- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch

- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch

- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch